MalwareIntelligence is a site dedicated to research on all matters relating to anti-malware security, criminology computing and information security in general, always from a perspective closely related to the field of intelligence.

28.6.09

ElFiesta is another member of the family of web applications, created by Russian developer and made available to cyber-criminals, who can't only monitor and manage each of the infected computers as part of its network (zombies), but also execute attacks via the web through various techniques that involve the exploitation of vulnerabilities.

One of the modules has ElFiesta precisely target the spread/infection via PDF (Portable Document Format) looking for vulnerabilities in some versions of Adobe Acrobat Reader.

In this case, the downloaded file is called 4573.pdf (MD5: b7b7d52a205e950adf4795c14c7f7178), whose name is random, has a detection rate of almost 50%, thus a very important infection rate at the moment.

As mentioned above, exploits a vulnerability (the CVE-2007-5659) multiple causes a buffer overflow through the pdf file previously handled by embedding a malicious script in the same JavaScript that downloads and executes a binary called load.exe (MD5: 5ee26f43139a2cdb3a79a835574285a0) from /load.php?id=1118&spl=3.

Another focuses ElFiesta modules incorporating a method of attack scripting subject to an obfuscation technique.

Making a deeper analysis of the case, we found a newly implemented version ElFiesta. In the following screen shows that the statistical information corresponds to our data.

These methods are common to most of crimeware applications of this style, but we appreciate a more interesting detail: the domain used is a known scareware called XP Police Antivirus.

Consequently, the first question that comes to mind is: XP Police Antivirus working with the recruitment ElFiesta zombie?

21.6.09

Koobface is a worm designed to exploit the user profiles of popular social networks like MySpace and FaceBook in order to obtain sensitive and confidential information of their victims, although the latest versions limiting their goal FaceBook. In fact, the word Koobface is a transposition of the word Facebook.

His early versions date back to late 2008 and since then continues In-the-Wild with an infection rate of concern. Thus, the same company released a series of preventive measures to minimize the potential risk of infection, which is constantly latent for users who use the social network.

In principle, the usual means of dissemination used Koobface is via web through visual Social Engineering and is the first facet of propagation.

The second facet (infection) channeled their malicious actions in a very common at present, based on a combination of malware, creating a symbiosis where each component of ambient display instructions to seek a common objective and comprehensive.

But let's see which are these components that form a part of the stage of infection of the variant Koobface. NBO. This worm, detected nowadays by approximately 31 companies antivirus of 41 (75.61 %), on having infected the system establishes connection with the following URL's:

Tinxy.AF, another trojan, it also creates files in the system and has a detection rate of slightly less than the previous 30/40 (75.00%).

C:\windows\ld09.exeC:\docume~1\user\locals~1\temp\podmena.bat

The trojan Tinxy.AD has a detection rate of 35/40, was detected by approximately 87.50% of the virus. Creates a copy of itself and makes use of the tool to enable a NetShell DLL, open ports, and specify a proxy.

BHO.NOE is another of the trojans as part of the process of infection Koobface, with a detection rate of 92.11% (35/38), create a folder and a file.

C:\WINDOWS\system32\796525

C:\WINDOWS\system32\796525\796525.dll

As to PSW.LdPinch.NEL trojan, detected by 34 antivirus of 40 (85.00%), is designed to steal passwords from different web browsers, mail clients, IM clients and other services.

Finally, download a variant of the family, the worm Koobface.NBH, in this case, the detection rate was 27/40 (approx. 67.50%).

As we can see, the infection of this malware isn't just limited to malicious instructions they have, but it goes beyond that and download another. This action is a common behavior in the present, where the fusion of Web applications and control of botnets and the administration of different types of malware, joining forces with a common goal: improving the economics of crime.